/*     */ package com.zimbra.qa.unittest.prov.ldap;
/*     */ 
/*     */ import com.zimbra.common.account.Key.AccountBy;
/*     */ import com.zimbra.common.service.ServiceException;
/*     */ import com.zimbra.cs.account.AccessManager;
/*     */ import com.zimbra.cs.account.Account;
/*     */ import com.zimbra.cs.account.DistributionList;
/*     */ import com.zimbra.cs.account.Domain;
/*     */ import com.zimbra.cs.account.Entry;
/*     */ import com.zimbra.cs.account.GlobalGrant;
/*     */ import com.zimbra.cs.account.GuestAccount;
/*     */ import com.zimbra.cs.account.NamedEntry;
/*     */ import com.zimbra.cs.account.accesscontrol.GranteeType;
/*     */ import com.zimbra.cs.account.accesscontrol.Right;
/*     */ import com.zimbra.cs.account.accesscontrol.RightCommand;
/*     */ import com.zimbra.cs.account.accesscontrol.Rights.Admin;
/*     */ import com.zimbra.cs.account.accesscontrol.TargetType;
/*     */ import com.zimbra.cs.account.ldap.LdapProv;
/*     */ import com.zimbra.soap.admin.type.GranteeSelector.GranteeBy;
/*     */ import com.zimbra.soap.type.TargetBy;
/*     */ import java.util.HashMap;
/*     */ import java.util.Map;
/*     */ import org.junit.AfterClass;
/*     */ import org.junit.Assert;
/*     */ import org.junit.BeforeClass;
/*     */ import org.junit.Test;
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ public class TestACLPermissionCache
/*     */   extends LdapTest
/*     */ {
/*     */   private static AccessManager accessMgr;
/*     */   private static Right A_USER_RIGHT;
/*     */   private static Right A_USER_RIGHT_DISTRIBUTION_LIST;
/*     */   private static Right A_CACHEABLE_ADMIN_RIGHT;
/*     */   private static final String GRANTTARGET_USER_ACCT = "granttarget-user-acct";
/*     */   private static final String GRANTTARGET_USER_GROUP = "granttarget-user-group";
/*     */   private static final String SUBGROUP_OF_GRANTTARGET_USER_GROUP = "subgroup-of-granttarget-user-group";
/*     */   private static final String TARGET_USER_ACCT = "target-user-acct";
/*     */   private static final String TARGET_USER_GROUP = "target-user-group";
/*     */   private static final String GRANTEE_USER_ACCT = "grantee-user-acct";
/*     */   private static final String GRANTEE_USER_GROUP = "grantee-user-group";
/*     */   private static final String GRANTEE_ADMIN_ACCT = "grantee-admin-acct";
/*     */   private static final String GRANTEE_ADMIN_GROUP = "grantee-admin-group";
/*     */   private static final String GRANTEE_GUEST_ACCT = "grantee-guest-acct";
/*     */   private static final String GRANTEE_GUEST_ACCT_PASSWORD = "grantee-guest-acct-password";
/*  76 */   private static int sequence = 1;
/*     */   private static LdapProvTestUtil provUtil;
/*     */   private static LdapProv mProv;
/*     */   private static Domain baseDomain;
/*     */   private static String BASE_DOMAIN_NAME;
/*     */   private static Account globalAdmin;
/*     */   
/*     */   @BeforeClass
/*     */   public static void init()
/*     */     throws Exception
/*     */   {
/*  87 */     provUtil = new LdapProvTestUtil();
/*  88 */     mProv = provUtil.getProv();
/*  89 */     baseDomain = provUtil.createDomain(baseDomainName());
/*  90 */     BASE_DOMAIN_NAME = baseDomain.getName();
/*  91 */     globalAdmin = provUtil.createGlobalAdmin("globaladmin", baseDomain);
/*     */     
/*  93 */     accessMgr = AccessManager.getInstance();
/*     */     
/*  95 */     ACLTestUtil.initTestRights();
/*  96 */     A_USER_RIGHT = ACLTestUtil.USER_RIGHT;
/*  97 */     A_USER_RIGHT_DISTRIBUTION_LIST = ACLTestUtil.USER_RIGHT_DISTRIBUTION_LIST;
/*  98 */     A_CACHEABLE_ADMIN_RIGHT = Rights.Admin.R_adminLoginAs;
/*     */   }
/*     */   
/*     */   @AfterClass
/*     */   public static void cleanup() throws Exception {
/* 103 */     Cleanup.deleteAll(new String[] { baseDomainName() });
/*     */   }
/*     */   
/*     */   private void grantRight(TargetType targetType, Entry target, GranteeType granteeType, NamedEntry grantee, Right right)
/*     */     throws ServiceException
/*     */   {
/* 109 */     grantRight(targetType, target, granteeType, grantee, null, right);
/*     */   }
/*     */   
/*     */   private void revokeRight(TargetType targetType, Entry target, GranteeType granteeType, NamedEntry grantee, Right right)
/*     */     throws ServiceException
/*     */   {
/* 115 */     RightCommand.revokeRight(mProv, globalAdmin, targetType.getCode(), TargetBy.name, target.getLabel(), granteeType.getCode(), GranteeSelector.GranteeBy.name, grantee.getName(), right.getName(), null);
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   private void grantRight(TargetType targetType, Entry target, GranteeType granteeType, NamedEntry grantee, String secret, Right right)
/*     */     throws ServiceException
/*     */   {
/* 126 */     RightCommand.grantRight(mProv, globalAdmin, targetType.getCode(), TargetBy.name, target.getLabel(), granteeType.getCode(), GranteeSelector.GranteeBy.name, grantee.getName(), secret, right.getName(), null);
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */   private static synchronized String nextSeq()
/*     */   {
/* 134 */     return "" + sequence++;
/*     */   }
/*     */   
/*     */   private String domainName() {
/* 138 */     return nextSeq() + "." + BASE_DOMAIN_NAME;
/*     */   }
/*     */   
/*     */   private Domain createDomain() throws Exception {
/* 142 */     return provUtil.createDomain(domainName());
/*     */   }
/*     */   
/*     */   private Account createUserAccount(String localpart, Domain domain) throws Exception {
/* 146 */     if (domain == null) {
/* 147 */       domain = createDomain();
/*     */     }
/* 149 */     return provUtil.createAccount(localpart, domain);
/*     */   }
/*     */   
/*     */   private Account createGuestAccount(String email, String password) {
/* 153 */     return new GuestAccount(email, password);
/*     */   }
/*     */   
/*     */   private Account createDelegatedAdminAccount(String localpart, Domain domain) throws Exception
/*     */   {
/* 158 */     if (domain == null) {
/* 159 */       domain = createDomain();
/*     */     }
/* 161 */     return provUtil.createDelegatedAdmin(localpart, domain);
/*     */   }
/*     */   
/*     */   private DistributionList createDistributionList(String localpart, Domain domain, Map<String, Object> attrs) throws Exception
/*     */   {
/* 166 */     if (domain == null) {
/* 167 */       domain = createDomain();
/*     */     }
/* 169 */     return provUtil.createDistributionList(localpart, domain, attrs);
/*     */   }
/*     */   
/*     */   private DistributionList createUserDistributionList(String localpart, Domain domain) throws Exception
/*     */   {
/* 174 */     return createDistributionList(localpart, domain, new HashMap());
/*     */   }
/*     */   
/*     */   private String getEmailLocalpart(String email) {
/* 178 */     String[] parts = email.split("@");
/* 179 */     return parts[0];
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */   @Test
/*     */   public void testGuestAccount()
/*     */     throws Exception
/*     */   {
/* 189 */     Right right = A_USER_RIGHT;
/*     */     
/* 191 */     Domain domain = createDomain();
/* 192 */     Account grantTarget = createUserAccount("granttarget-user-acct", domain);
/* 193 */     Account target = grantTarget;
/* 194 */     Account grantee = createGuestAccount("grantee-guest-acct", "grantee-guest-acct-password");
/* 195 */     Account notGrantee = createGuestAccount("grantee-user-acctnot", "grantee-guest-acct-password");
/*     */     
/*     */ 
/*     */ 
/* 199 */     grantRight(TargetType.account, grantTarget, GranteeType.GT_GUEST, grantee, "grantee-guest-acct-password", right);
/* 200 */     boolean allow = accessMgr.canDo(grantee, target, right, false, null);
/* 201 */     Assert.assertTrue(allow);
/* 202 */     allow = accessMgr.canDo(notGrantee, target, right, false, null);
/* 203 */     Assert.assertFalse(allow);
/*     */   }
/*     */   
/*     */   @Test
/*     */   public void testGrantChangeOnTarget() throws Exception {
/* 208 */     Right right = A_USER_RIGHT;
/*     */     
/* 210 */     Domain domain = createDomain();
/* 211 */     Account grantTarget = createUserAccount("granttarget-user-acct", domain);
/* 212 */     Account target = grantTarget;
/* 213 */     Account grantee = createUserAccount("grantee-user-acct", domain);
/*     */     
/*     */ 
/*     */ 
/* 217 */     grantRight(TargetType.account, grantTarget, GranteeType.GT_USER, grantee, right);
/* 218 */     boolean allow = accessMgr.canDo(grantee, target, right, false, null);
/* 219 */     Assert.assertTrue(allow);
/*     */     
/* 221 */     revokeRight(TargetType.account, grantTarget, GranteeType.GT_USER, grantee, right);
/* 222 */     allow = accessMgr.canDo(grantee, target, right, false, null);
/* 223 */     Assert.assertFalse(allow);
/*     */     
/* 225 */     grantRight(TargetType.account, grantTarget, GranteeType.GT_USER, grantee, right);
/* 226 */     allow = accessMgr.canDo(grantee, target, right, false, null);
/* 227 */     Assert.assertTrue(allow);
/*     */   }
/*     */   
/*     */   @Test
/*     */   public void testGrantChangeOnDirectlyInheritedDistributionList() throws Exception {
/* 232 */     Right right = A_USER_RIGHT_DISTRIBUTION_LIST;
/*     */     
/* 234 */     Domain domain = createDomain();
/* 235 */     DistributionList grantTarget = createUserDistributionList("granttarget-user-group", domain);
/* 236 */     DistributionList target = createUserDistributionList("target-user-group", domain);
/* 237 */     Account grantee = createUserAccount("grantee-user-acct", domain);
/*     */     
/* 239 */     mProv.addMembers(grantTarget, new String[] { target.getName() });
/*     */     
/*     */ 
/*     */ 
/* 243 */     grantRight(TargetType.dl, grantTarget, GranteeType.GT_USER, grantee, right);
/* 244 */     boolean allow = accessMgr.canDo(grantee, target, right, false, null);
/* 245 */     Assert.assertTrue(allow);
/*     */     
/* 247 */     revokeRight(TargetType.dl, grantTarget, GranteeType.GT_USER, grantee, right);
/* 248 */     allow = accessMgr.canDo(grantee, target, right, false, null);
/* 249 */     Assert.assertFalse(allow);
/*     */     
/* 251 */     grantRight(TargetType.dl, grantTarget, GranteeType.GT_USER, grantee, right);
/* 252 */     allow = accessMgr.canDo(grantee, target, right, false, null);
/* 253 */     Assert.assertTrue(allow);
/*     */   }
/*     */   
/*     */   @Test
/*     */   public void testGrantChangeOnIndirectlyInheritedDistributionList() throws Exception {
/* 258 */     Right right = A_USER_RIGHT_DISTRIBUTION_LIST;
/*     */     
/* 260 */     Domain domain = createDomain();
/* 261 */     DistributionList grantTarget = createUserDistributionList("granttarget-user-group", domain);
/* 262 */     DistributionList subGroup = createUserDistributionList("subgroup-of-granttarget-user-group", domain);
/* 263 */     DistributionList target = createUserDistributionList("target-user-group", domain);
/* 264 */     Account grantee = createUserAccount("grantee-user-acct", domain);
/*     */     
/* 266 */     mProv.addMembers(grantTarget, new String[] { subGroup.getName() });
/* 267 */     mProv.addMembers(subGroup, new String[] { target.getName() });
/*     */     
/*     */ 
/*     */ 
/* 271 */     grantRight(TargetType.dl, grantTarget, GranteeType.GT_USER, grantee, right);
/* 272 */     boolean allow = accessMgr.canDo(grantee, target, right, false, null);
/* 273 */     Assert.assertTrue(allow);
/*     */     
/* 275 */     revokeRight(TargetType.dl, grantTarget, GranteeType.GT_USER, grantee, right);
/* 276 */     allow = accessMgr.canDo(grantee, target, right, false, null);
/* 277 */     Assert.assertFalse(allow);
/*     */     
/* 279 */     grantRight(TargetType.dl, grantTarget, GranteeType.GT_USER, grantee, right);
/* 280 */     allow = accessMgr.canDo(grantee, target, right, false, null);
/* 281 */     Assert.assertTrue(allow);
/*     */   }
/*     */   
/*     */   @Test
/*     */   public void testGrantChangeOnDomain() throws Exception {
/* 286 */     Right right = A_USER_RIGHT;
/*     */     
/* 288 */     Domain domain = createDomain();
/* 289 */     Domain grantTarget = domain;
/* 290 */     Account target = createUserAccount("target-user-acct", domain);
/* 291 */     Account grantee = createUserAccount("grantee-user-acct", domain);
/*     */     
/*     */ 
/*     */ 
/* 295 */     grantRight(TargetType.domain, grantTarget, GranteeType.GT_USER, grantee, right);
/* 296 */     boolean allow = accessMgr.canDo(grantee, target, right, false, null);
/* 297 */     Assert.assertTrue(allow);
/*     */     
/* 299 */     revokeRight(TargetType.domain, grantTarget, GranteeType.GT_USER, grantee, right);
/* 300 */     allow = accessMgr.canDo(grantee, target, right, false, null);
/* 301 */     Assert.assertFalse(allow);
/*     */     
/* 303 */     grantRight(TargetType.domain, grantTarget, GranteeType.GT_USER, grantee, right);
/* 304 */     allow = accessMgr.canDo(grantee, target, right, false, null);
/* 305 */     Assert.assertTrue(allow);
/*     */   }
/*     */   
/*     */   @Test
/*     */   public void testGrantChangeOnGlobalGrant() throws Exception {
/* 310 */     Right right = A_USER_RIGHT;
/*     */     
/* 312 */     Domain domain = createDomain();
/* 313 */     GlobalGrant grantTarget = mProv.getGlobalGrant();
/* 314 */     Account target = createUserAccount("target-user-acct", domain);
/* 315 */     Account grantee = createUserAccount("grantee-user-acct", domain);
/*     */     
/*     */ 
/*     */ 
/* 319 */     grantRight(TargetType.global, grantTarget, GranteeType.GT_USER, grantee, right);
/* 320 */     boolean allow = accessMgr.canDo(grantee, target, right, false, null);
/* 321 */     Assert.assertTrue(allow);
/*     */     
/* 323 */     revokeRight(TargetType.global, grantTarget, GranteeType.GT_USER, grantee, right);
/* 324 */     allow = accessMgr.canDo(grantee, target, right, false, null);
/* 325 */     Assert.assertFalse(allow);
/*     */     
/* 327 */     grantRight(TargetType.global, grantTarget, GranteeType.GT_USER, grantee, right);
/* 328 */     allow = accessMgr.canDo(grantee, target, right, false, null);
/* 329 */     Assert.assertTrue(allow);
/*     */   }
/*     */   
/*     */   @Test
/*     */   public void testDirectGroupMembershipChanged() throws Exception {
/* 334 */     Right right = A_USER_RIGHT_DISTRIBUTION_LIST;
/*     */     
/* 336 */     Domain domain = createDomain();
/* 337 */     DistributionList grantTarget = createUserDistributionList("granttarget-user-group", domain);
/* 338 */     DistributionList target = createUserDistributionList("target-user-group", domain);
/* 339 */     Account grantee = createUserAccount("grantee-user-acct", domain);
/*     */     
/* 341 */     mProv.addMembers(grantTarget, new String[] { target.getName() });
/*     */     
/*     */ 
/*     */ 
/* 345 */     grantRight(TargetType.dl, grantTarget, GranteeType.GT_USER, grantee, right);
/* 346 */     boolean allow = accessMgr.canDo(grantee, target, right, false, null);
/* 347 */     Assert.assertTrue(allow);
/*     */     
/* 349 */     mProv.removeMembers(grantTarget, new String[] { target.getName() });
/* 350 */     allow = accessMgr.canDo(grantee, target, right, false, null);
/* 351 */     Assert.assertFalse(allow);
/*     */     
/* 353 */     mProv.addMembers(grantTarget, new String[] { target.getName() });
/* 354 */     allow = accessMgr.canDo(grantee, target, right, false, null);
/* 355 */     Assert.assertTrue(allow);
/*     */   }
/*     */   
/*     */   @Test
/*     */   public void testIndirectGroupMembershipChanged() throws Exception {
/* 360 */     Right right = A_USER_RIGHT_DISTRIBUTION_LIST;
/*     */     
/* 362 */     Domain domain = createDomain();
/* 363 */     DistributionList grantTarget = createUserDistributionList("granttarget-user-group", domain);
/* 364 */     DistributionList subGroup = createUserDistributionList("subgroup-of-granttarget-user-group", domain);
/* 365 */     DistributionList target = createUserDistributionList("target-user-group", domain);
/* 366 */     Account grantee = createUserAccount("grantee-user-acct", domain);
/*     */     
/* 368 */     mProv.addMembers(grantTarget, new String[] { subGroup.getName() });
/* 369 */     mProv.addMembers(subGroup, new String[] { target.getName() });
/*     */     
/*     */ 
/*     */ 
/* 373 */     grantRight(TargetType.dl, grantTarget, GranteeType.GT_USER, grantee, right);
/* 374 */     boolean allow = accessMgr.canDo(grantee, target, right, false, null);
/* 375 */     Assert.assertTrue(allow);
/*     */     
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/* 385 */     mProv.removeMembers(subGroup, new String[] { target.getName() });
/* 386 */     allow = accessMgr.canDo(grantee, target, right, false, null);
/* 387 */     Assert.assertFalse(allow);
/*     */     
/* 389 */     mProv.addMembers(subGroup, new String[] { target.getName() });
/* 390 */     allow = accessMgr.canDo(grantee, target, right, false, null);
/* 391 */     Assert.assertTrue(allow);
/*     */   }
/*     */   
/*     */   @Test
/*     */   public void testDomainOfTargetChanged() throws Exception {
/* 396 */     Right right = A_USER_RIGHT;
/*     */     
/* 398 */     Domain domain = createDomain();
/* 399 */     Domain grantTarget = domain;
/* 400 */     Account target = createUserAccount("target-user-acct", domain);
/* 401 */     Account grantee = createUserAccount("grantee-user-acct", domain);
/*     */     
/*     */ 
/*     */ 
/* 405 */     grantRight(TargetType.domain, grantTarget, GranteeType.GT_USER, grantee, right);
/* 406 */     boolean allow = accessMgr.canDo(grantee, target, right, false, null);
/* 407 */     Assert.assertTrue(allow);
/*     */     
/* 409 */     Domain newDomain = createDomain();
/* 410 */     String id = target.getId();
/* 411 */     String oldName = target.getName();
/* 412 */     String newName = getEmailLocalpart(target.getName()) + "@" + newDomain.getName();
/* 413 */     mProv.renameAccount(id, newName);
/* 414 */     target = mProv.get(Key.AccountBy.id, id);
/* 415 */     allow = accessMgr.canDo(grantee, target, right, false, null);
/* 416 */     Assert.assertFalse(allow);
/*     */     
/* 418 */     mProv.renameAccount(id, oldName);
/* 419 */     target = mProv.get(Key.AccountBy.id, id);
/* 420 */     allow = accessMgr.canDo(grantee, target, right, false, null);
/* 421 */     Assert.assertTrue(allow);
/*     */   }
/*     */   
/*     */   @Test
/*     */   public void GrantTargetDeleted() throws Exception {
/* 426 */     Right right = A_USER_RIGHT_DISTRIBUTION_LIST;
/*     */     
/* 428 */     Domain domain = createDomain();
/* 429 */     DistributionList grantTarget = createUserDistributionList("granttarget-user-group", domain);
/* 430 */     DistributionList subGroup = createUserDistributionList("subgroup-of-granttarget-user-group", domain);
/* 431 */     DistributionList target = createUserDistributionList("target-user-group", domain);
/* 432 */     Account grantee = createUserAccount("grantee-user-acct", domain);
/*     */     
/* 434 */     mProv.addMembers(grantTarget, new String[] { subGroup.getName() });
/* 435 */     mProv.addMembers(subGroup, new String[] { target.getName() });
/*     */     
/*     */ 
/*     */ 
/* 439 */     grantRight(TargetType.dl, grantTarget, GranteeType.GT_USER, grantee, right);
/* 440 */     boolean allow = accessMgr.canDo(grantee, target, right, false, null);
/* 441 */     Assert.assertTrue(allow);
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   @Test
/*     */   public void testGranteeGroupMembershipChanged()
/*     */     throws Exception
/*     */   {
/* 459 */     Right right = A_USER_RIGHT;
/*     */     
/* 461 */     Domain domain = createDomain();
/* 462 */     Account grantTarget = createUserAccount("granttarget-user-acct", domain);
/* 463 */     Account target = grantTarget;
/* 464 */     DistributionList grantee = createUserDistributionList("grantee-user-group", domain);
/* 465 */     Account account = createUserAccount("grantee-user-acct", domain);
/*     */     
/* 467 */     mProv.addMembers(grantee, new String[] { account.getName() });
/*     */     
/*     */ 
/*     */ 
/* 471 */     grantRight(TargetType.account, grantTarget, GranteeType.GT_GROUP, grantee, right);
/* 472 */     boolean allow = accessMgr.canDo(account, target, right, false, null);
/* 473 */     Assert.assertTrue(allow);
/*     */     
/* 475 */     mProv.removeMembers(grantee, new String[] { account.getName() });
/* 476 */     allow = accessMgr.canDo(account, target, right, false, null);
/* 477 */     Assert.assertFalse(allow);
/*     */   }
/*     */   
/*     */   @Test
/*     */   public void testGranteeAdminFlagChanged() throws Exception {
/* 482 */     Right right = A_CACHEABLE_ADMIN_RIGHT;
/*     */     
/* 484 */     Domain domain = createDomain();
/* 485 */     Account grantTarget = createUserAccount("granttarget-user-acct", domain);
/* 486 */     Account target = grantTarget;
/* 487 */     Account grantee = createDelegatedAdminAccount("grantee-admin-acct", domain);
/*     */     
/*     */ 
/*     */ 
/* 491 */     grantRight(TargetType.account, grantTarget, GranteeType.GT_USER, grantee, right);
/* 492 */     boolean allow = accessMgr.canDo(grantee, target, right, true, null);
/* 493 */     Assert.assertTrue(allow);
/*     */     
/* 495 */     grantee.setIsDelegatedAdminAccount(false);
/*     */     try {
/* 497 */       allow = accessMgr.canDo(grantee, target, right, true, null);
/*     */     } catch (ServiceException e) {
/* 499 */       if ("service.PERM_DENIED".equals(e.getCode()))
/* 500 */         allow = false;
/*     */     }
/* 502 */     Assert.assertFalse(allow);
/*     */     
/* 504 */     grantee.setIsDelegatedAdminAccount(true);
/* 505 */     allow = accessMgr.canDo(grantee, target, right, true, null);
/* 506 */     Assert.assertTrue(allow);
/*     */   }
/*     */ }


/* Location:              /home/mint/zimbrastore.jar!/com/zimbra/qa/unittest/prov/ldap/TestACLPermissionCache.class
 * Java compiler version: 7 (51.0)
 * JD-Core Version:       0.7.1
 */